Draft — for legal review
Privacy Policy
This policy explains how [COMPANY NAME] ("ClinicBuild", "we", "us") collects and uses personal data when you use clinicbuild.co.uk or contact us about our services. We are the data controller for the information described here. This policy does not cover patient data held by a pharmacy that uses our platform — for that, the pharmacy is the controller and its own privacy notice applies.
Last updated 30 September 2026
Who we are
[COMPANY NAME], a company registered in England and Wales, company number [COMPANY NUMBER], registered office [ADDRESS]. We are registered with the Information Commissioner’s Office under [ICO REGISTRATION NUMBER].
If you have a question about this policy or about how we handle your data, email hello@clinicbuild.co.uk.
What we collect
When you complete a form on this site we collect: your name, pharmacy name, role, email address, telephone number, postcode, your preferred contact times, and whatever you tell us about your pharmacy — including whether you have a website, approximate patient volumes, how you manage bookings, whether you hold PGDs, who provides your SOPs, whether you have an Independent Prescriber in house, which service interests you, and any free-text message.
We also collect a small amount of technical data automatically: your IP address, browser and device type, and the pages you visited. This is used to keep the site secure and to understand which pages are useful.
We do not ask for, and do not want, patient data, clinical information or special category data through this website. Please do not send it to us using these forms.
Why we use it, and our lawful basis
To reply to your enquiry and discuss whether our services fit your pharmacy — our lawful basis is legitimate interests (responding to a business enquiry you initiated).
To prepare a proposal, quote or catchment analysis for you — legitimate interests, or the performance of a contract where one is in place.
To send you occasional updates about our services, where you have asked for them — consent, which you can withdraw at any time by replying to any message or emailing us.
To keep the site secure and prevent spam and abuse — legitimate interests.
To meet our legal and accounting obligations — legal obligation.
Form handling and processors
Forms on this site are delivered to our inbox by Web3Forms, a form-delivery service acting as our processor. Submissions are transmitted over HTTPS. We use a hidden honeypot field to filter automated spam; no CAPTCHA and no tracking cookie is involved in submitting a form.
Our other processors are our website host and CDN (Vercel Inc.) and our email provider. Each is bound by a written data processing agreement. Where a processor transfers data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or an adequacy decision.
Cookies and analytics
This site sets no advertising cookies and no third-party tracking cookies. We do not use cookies to profile you.
If we add analytics in future it will be a privacy-preserving, cookieless measurement tool, and this policy will be updated before it goes live. Any non-essential cookie would be set only with your consent, through a banner you can decline without losing access to the site.
How long we keep it
Enquiries that do not become a client relationship: 24 months from your last contact with us, then deleted.
Client records: for the duration of the partnership and then six years, to meet contractual, tax and accounting obligations.
Server and security logs: 30 days.
Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to our processing of it, to data portability, and to withdraw consent where consent is the basis we rely on.
To exercise any of these, email hello@clinicbuild.co.uk. We will respond within one month, and there is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.
Data we process for pharmacies
Where a pharmacy engages us to build and run a clinic, that pharmacy is the data controller for its patient data and we act as its processor under a written data processing agreement. Patient data is held under the pharmacy’s GPhC registration. Patients should refer to that pharmacy’s own privacy notice, not this one.
Changes to this policy
We will update this page if our processing changes, and we will change the "last updated" date below. If a change materially affects you and we hold your contact details, we will tell you.